Subject: [mobile-ip] SA b/w MN and HA of foreign n/w(smooth handoff case)

From: [email-masked]
Date: Tue, 17 Sep 2002 09:01:55 +0530

hi,
 In the section 14.3 ("Security features: Binding updates to Home agents"),
it has been mentioned that  for forwarding from a previous care-of address
"a prearranged security association must exist b/w MN and the temporary
home agent" i.e. if we want to support smooth hand-off there should be a SA
existing b/w the MN and HA of foreign network.
How is this SA arranged? is this manually done by the administrator or is
this achieved using IKE?

regards
  gaurav

---

From: Jari Arkko <[email-masked]>
Date: Tue, 17 Sep 2002 11:16:24 +0300

> How is this SA arranged? is this manually done by the administrator or is

This is the subject of the debate under the heading "Mobile IPv6 - Issue 72
(Forwarding from Previous CoA)".

In the basic mobile node - home agent case there's some published text on
how to set up the manual SAs and policy entries (the URL is in the mail
sent by Kevin Miles). IKE wasn't considered in this note, but I'm working
together with Vijay and Francis to produce an updated note in draft form
about this.

For the previous-router-become-temp-ha case there are some additional
issues, which I listed in the discussion mentioned above. Copying
from there:

    One problem is that the number of SAs in the manual case
    grows unreasonably large when each MN needs an SA to every
    place where it might possibly go to. This also applies to
    the address-specific policy data base that we need even if
    dynamic keying is used. In the multiple-HA case the size
    of the necessary data bases is proportional to the number
    of home addresses. In the prev-coa-forwarding case its
    proportional to the number of interface IDs times the
    number of prefixes.

    Since all of this is pretty much based on addresses, we
    need to ensure address uniqueness even for care-of addresses
    on the whole network and not just at one link. There may be
    other issues that we haven't thought of.

Jari

---

From: "James Kempf" <[email-masked]>
Date: Tue, 17 Sep 2002 09:45:46 -0700

Jari,

There's another consideration here.

If the SEND (SEcuring Neighbor Discovery) work successfully concludes, it should
be possible to set up a security association between any IPv6 router and a host,
in some fashion. This would apply to a mobile node and an access router as well.

SEND would be an excellent alternative to requiring the same level of security
as with a home agent. This is another reason why I think it would be better to
move forwarding from previous care of address into the fast handoff draft. It is
currently cast as a "on link home agent" but it really has to do with the access
router. Recognizing that, and designing the security to properly account for the
kinds of threats that that entails, is necessary. SEND and the fast handover
work are complementary.

            jak

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 17 Sep 2002 17:03:14 -0700

Another relevant piece can be PANA.
It's used in authenticating (and authorizing)
clients for network access. When this protocol
is used, mobile node would implement PANA client,
and routers would implement the PANA authentication
agent. One can bootstrap a trust relation between these
entities upon successful PANA exchange. Some additional
things need to be worked out for turning this relation into
a security association for Mobile IP or neighbor discovery
uses..

alper

----- Original Message -----
From: "James Kempf" <[email-masked]>
To: "Jari Arkko" <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, September 17, 2002 9:45 AM
Subject: Re: [mobile-ip] SA b/w MN and HA of foreign n/w(smooth handoff
case)

---

From: Jari Arkko <[email-masked]>
Date: Wed, 18 Sep 2002 12:53:13 +0300

James Kempf wrote:

> It is

Yes, agreed.

Jari